What’s Vulnerable › Vulnerabilities

CVE-2026-97539: usb: xusbatm: don't rely on id table pointer arithmetic

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usb_device_id parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. xusbatm initialize the USB device IDs dynamically so it can just use driver_info too. Even with conversion, xusbatm still cannot support dynamic IDs, so also set no_dynamic_id.

Affected products

• Linux kernel: 2.6.16 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/5086f5639197f321b766cec0dce383492eaf2305
• https://git.kernel.org/stable/c/8944ef1bfda537aaf329c82e7a5f9faf61340aa9
• https://git.kernel.org/stable/c/eb6cd6d3d8abeac5d7e8251b898067184afdad8a
• https://git.kernel.org/stable/c/ee4006c2175e8b50ff5d47a54bff52eb29bb1f0d
• https://git.kernel.org/stable/c/f7db611d98b68d15661561d2cefa774208774ccc
• https://git.kernel.org/stable/c/fad6cab36474758abf55c6419dd79a06a27fcefc

Get alerted when CVE-2026-97539 or the next vulnerability affects your stack